1d243673792c4adbf88a71a8ac212f7087f35c6773dbe7e8e4b7cfb74a643464

Analysis

max time kernel
150s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/08/2026, 04:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_8251f64005da2fb64973baa85c95ad96_elex_wannacry.exe
Size 20.8MB
Sample260813-e2tv8a1hkd
SHA256 1d243673792c4adbf88a71a8ac212f7087f35c6773dbe7e8e4b7cfb74a643464
MD5 8251f64005da2fb64973baa85c95ad96
SHA1 f575165373234387598afe7551aeaadccb18a860
SHA512 633d91b04c78d5691b3faba5bcbff210a05981d074afc283005cb5e02be08922823d6ec68f4b6dfe11ee6dff34975f1e00746ab3738fddeb9919a69ec84b2ed0
SSDEEP 49152:U+E2+ESB+ES+E2+EE+ES+Ek+ES+ES+E2+ESB+ES+E2+EE+ES+Ek+ES+ES+E2+ESa:T
TLSH
T17D270909F94340B1DD2B50F04DCFE3BF8A60AB25C6128EF7FB4DCB5BA522BA16428555
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_AABBAABCBAAABCAABACCCBBBBBCBCACABAAACCCAACBAAACBBAACCAA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_AABBAABCBAAABCAABACCCBBBBBCBCACABAAACCCAACBAAACBBAACCAA.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4796	svchost_AABBAABCBAAABCAABACCCBBBBBCBCACABAAACCCAACBAAACBBAACCAA.exe
3376	svchost_CCBABAABCACCCCAACCAACBAAABACBABACABACCCBACACBCCBABABCCC.exe
1640	svchost_AABBAABCBAAABCAABACCCBBBBBCBCACABAAACCCAACBAAACBBAACCAA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CBBAABBAABCCCACACCBCBBBCAAAAAABBAABCACACCACBCBBBBABCBABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AABBAABCBAAABCAABACCCBBBBBCBCACABAAACCCAACBAAACBBAACCAA.exe"	2026-08-13_8251f64005da2fb64973baa85c95ad96_elex_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_AAACCCBBCBCABACCCAABAABBCCBBACAAAABBACAABCAACBAAACACAABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCBABAABCACCCCAACCAACBAAABACBABACABACCCBACACBCCBABABCCC.exe"	svchost_AABBAABCBAAABCAABACCCBBBBBCBCACABAAACCCAACBAAACBBAACCAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4236	sc.exe
4240	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1660	cmd.exe
4900	cmd.exe
1796	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_8251f64005da2fb64973baa85c95ad96_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AABBAABCBAAABCAABACCCBBBBBCBCACABAAACCCAACBAAACBBAACCAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCBABAABCACCCCAACCAACBAAABACBABACABACCCBACACBCCBABABCCC.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4220	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
988	2026-08-13_8251f64005da2fb64973baa85c95ad96_elex_wannacry.exe
988	2026-08-13_8251f64005da2fb64973baa85c95ad96_elex_wannacry.exe
988	2026-08-13_8251f64005da2fb64973baa85c95ad96_elex_wannacry.exe
988	2026-08-13_8251f64005da2fb64973baa85c95ad96_elex_wannacry.exe
4796	svchost_AABBAABCBAAABCAABACCCBBBBBCBCACABAAACCCAACBAAACBBAACCAA.exe
4796	svchost_AABBAABCBAAABCAABACCCBBBBBCBCACABAAACCCAACBAAACBBAACCAA.exe
4796	svchost_AABBAABCBAAABCAABACCCBBBBBCBCACABAAACCCAACBAAACBBAACCAA.exe
4796	svchost_AABBAABCBAAABCAABACCCBBBBBCBCACABAAACCCAACBAAACBBAACCAA.exe
1640	svchost_AABBAABCBAAABCAABACCCBBBBBCBCACABAAACCCAACBAAACBBAACCAA.exe
1640	svchost_AABBAABCBAAABCAABACCCBBBBBCBCACABAAACCCAACBAAACBBAACCAA.exe
3376	svchost_CCBABAABCACCCCAACCAACBAAABACBABACABACCCBACACBCCBABABCCC.exe
3376	svchost_CCBABAABCACCCCAACCAACBAAABACBABACABACCCBACACBCCBABABCCC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	988	2026-08-13_8251f64005da2fb64973baa85c95ad96_elex_wannacry.exe
Token: SeDebugPrivilege	4796	svchost_AABBAABCBAAABCAABACCCBBBBBCBCACABAAACCCAACBAAACBBAACCAA.exe
Token: SeDebugPrivilege	1640	svchost_AABBAABCBAAABCAABACCCBBBBBCBCACABAAACCCAACBAAACBBAACCAA.exe
Token: SeDebugPrivilege	3376	svchost_CCBABAABCACCCCAACCAACBAAABACBABACABACCCBACACBCCBABABCCC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1036	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 988 wrote to memory of 1796	988	2026-08-13_8251f64005da2fb64973baa85c95ad96_elex_wannacry.exe	102
PID 1796 wrote to memory of 4220	1796	cmd.exe	104
PID 4796 wrote to memory of 3780	4796	svchost_AABBAABCBAAABCAABACCCBBBBBCBCACABAAACCCAACBAAACBBAACCAA.exe	106
PID 3780 wrote to memory of 4084	3780	notepad.exe	107
PID 988 wrote to memory of 1660	988	2026-08-13_8251f64005da2fb64973baa85c95ad96_elex_wannacry.exe	111
PID 1660 wrote to memory of 4236	1660	cmd.exe	113
PID 988 wrote to memory of 4900	988	2026-08-13_8251f64005da2fb64973baa85c95ad96_elex_wannacry.exe	114
PID 4900 wrote to memory of 4240	4900	cmd.exe	116

C:\Users\Admin\AppData\Local\Temp\2026-08-13_8251f64005da2fb64973baa85c95ad96_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_8251f64005da2fb64973baa85c95ad96_elex_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:988
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAABBCCAACBBBACCCCBACACBCABBBAABCBABBACBBACACACACBCBCBCAAABBCBCBCBCCBBBCAACBABBCCABCBACBBAABBBBAABCAACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBAABCBAAABCAABACCCBBBBBCBCACABAAACCCAACBAAACBBAACCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1796
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAABBCCAACBBBACCCCBACACBCABBBAABCBABBACBBACACACACBCBCBCAAABBCBCBCBCCBBBCAACBABBCCABCBACBBAABBBBAABCAACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBAABCBAAABCAABACCCBBBBBCBCACABAAACCCAACBAAACBBAACCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4220
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCBACAABAAACABCACAABBBABACCABABBBACCCBBABBACBBCCCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBAABCBAAABCAABACCCBBBBBCBCACABAAACCCAACBAAACBBAACCAA.exe" start= auto displayName= "UserDataSvc_CCBACAABAAACABCACAABBBABACCABABBBACCCBBABBACBBCCCCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1660
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCBACAABAAACABCACAABBBABACCABABBBACCCBBABBACBBCCCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBAABCBAAABCAABACCCBBBBBCBCACABAAACCCAACBAAACBBAACCAA.exe" start= auto displayName= "UserDataSvc_CCBACAABAAACABCACAABBBABACCABABBBACCCBBABBACBBCCCCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4236
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCBACAABAAACABCACAABBBABACCABABBBACCCBBABBACBBCCCCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4900
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCBACAABAAACABCACAABBBABACCABABBBACCCBBABBACBBCCCCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4240

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBAABCBAAABCAABACCCBBBBBCBCACABAAACCCAACBAAACBBAACCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBAABCBAAABCAABACCCBBBBBCBCACABAAACCCAACBAAACBBAACCAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3780
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4084

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1036

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABAABCACCCCAACCAACBAAABACBABACABACCCBACACBCCBABABCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABAABCACCCCAACCAACBAAABACBABACABACCCBACACBCCBABABCCC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3376

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBAABCBAAABCAABACCCBBBBBCBCACABAAACCCAACBAAACBBAACCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBAABCBAAABCAABACCCBBBBBCBCACABAAACCCAACBAAACBBAACCAA.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1640

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 ce1e57cc870920adfa612619bc0216e46f29b985c1ee8e6cbfaf26d0381811a2
MD5 11a62db7d9728173549b00aef327d6be
SHA1 5fa8f1fb8244fd2f21c8b9cf1f9ca4c68d0b0291
SHA512 01298e5fab2ba2928b5b4549de035663b09bff019b5fc7b514c743ee1bb18846e40ba8779dc83ff2ae605f5e780d9f29e09548711ff2d7bad0bdbab2088966b1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Windows.CBSPreview_10.0.19041.1023_neutral_neutral_cw5n1h2txyewy\qap`g`v~dtlq
Size 10B
SHA256 4322f2863a72ca084265db63a8560e6539ad42867125716a57a48efaa52d2573
MD5 b36caf570ce3847beb44b4a044fb7dc8
SHA1 2b084302d5740f08feb224c6a65442cc46328f16
SHA512 106524f5de37830bf1f24432fa2a3e9d90dd21f0f03cb0bacf653c4f3c3c054bc510808ed70972383a3ce05caf380ec4e831091aae76d37babc002c72a5dab3a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\Microsoft.549981C3F5F10_8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 8260ab1881e4d37c83d949810e8114f65b200c4f4c9ab0e3d3ca2d23b46ab5f6
MD5 80b082b6415318f16315db4acfa1d90d
SHA1 11a599c39df0ca79b2c9bb291f82cf2d90d6d3bd
SHA512 ceb64da59c7ee8bb77dd77de5c54ba7b2b25f0c57e8d9cba8cc2ef99d68149ae5f3e3d9f336ed831704f09efab0aa09df833db1f0e87d306652c9be98a417b89
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\59\qap`g`v~dtlq
Size 10B
SHA256 3388ee6f3f9bf1820a3547e297b6f1a1e1e22b84a0eb149e4c03ee4db5751421
MD5 2307c5741bd8769b675cfc62fe7ae432
SHA1 550961dbec5f81cdd780013cb4ae0372ad9f2c5f
SHA512 1014d3b782a694b009e5e0acba6ab177399e34a231aa487fa93dc8802d778d48798bca8ade16d0bf6331f18f0b253018be64513c77dce0d79bfd156fc41c1302
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\TpcdMetadata\qap`g`v~dtlq
Size 10B
SHA256 70aa93d8a539844f65c5706b9b5f9048c09ff5ab4deb83d873d3f448d2464a17
MD5 211ad452ca5d8b7093ee02b521e5e2db
SHA1 0df0d2c486fd53161649d2ace7b1e011cf8db0a2
SHA512 4af7cf1c08ae8fa9d97f785b226241facc34496411f180fe92a172b4126c3989a558a6452def49605661fa787c90f0580d9933a9d24426be084b29fc81623afa
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\RoamingState\qap`g`v~dtlq
Size 10B
SHA256 cb745e78694483698e42ec94757e494e82bf9bb590caa0052eb5cefcf481941b
MD5 8da77f0b8ba0cba1e03bccca9be7a0ed
SHA1 3c64fd2160fa1ffd6321dd8614166017d1110ca1
SHA512 4fe5292f281e092570218f3f67a6b7676a7d8d4e35a9a2fd61943dc54f427cb46a7a0415af75c488e38799351b97dcef1f4b85b27faa980e1d019b2c5ce300c6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0ca2f37b19af7c491d38a67fd842ff7a949a148d1b835ec482da879eed334460
MD5 ece5e787a6c94d98b66b8e2ef3ca1f6c
SHA1 b3f5504abad724dab1c0cfeefa4104d53ea92f85
SHA512 59344611af2e1f1184b414f05982f79521517b0d4d3f86cb4fd193bf1385568d854a75c2acd961092362b00d00595274d361fb85d20e740fd19b851f956b559a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b41b72eeca997f49e388743eecc858c314b684b2ba361858b24d94b8ac5f584d
MD5 1cea021c48b20909b8a1ee9c7319d1bf
SHA1 616643ecdbcac2cbc1cf74c0c9dbf37384ecc77a
SHA512 c42690fde2ff0c8c1cb98e5e0aac6a73ab7b634713b1a64e6768995781daf7bd7560d8bd26d0cd0329c933aec13a0e1bc66ccb51457173187b075ee7b4947aec
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 72db0d38849ebad6e820722fa1844bc64f761d8d95d6c8ed70dd9a5bf9252ecb
MD5 87d426be9d4267e9b32129f572ea1345
SHA1 9fefcf2ac13daf5cb184b3da0ab444137d44530f
SHA512 25355879d1302134b0edd8cafb8a74e2ce702874d82c8379b1dc43e3759853b87c5ab75ada6030df1593cc93b33ca59b5493c331fe02a2686e2173e852912862
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 470ddfce265a58f4e4cfb815b5771db32e5efef2a7307dafea840849e8d30d84
MD5 e0bcbb0f96bb11199c124d78550678a2
SHA1 9b04fdd899f1b3ae41e44fde38cdb9c0e1f11671
SHA512 13db3e2c5b647b49faf1c45cf5122c1c9842299a669a902b50606c47195cb4c36d3e24ec61c37766fab84dbd6e748e8b9267c4c15d7d1ac19408511c794668ac
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f41c20134163c479f99815642d5b73496962e746838dc696699cbaa3332ffe21
MD5 f950ac03173741d9212f4d97ec60a47d
SHA1 3afbd102542fd8259fe50da6030bd6e3a6d4da93
SHA512 d6772637417cc2cc661e7d9b3499a2a63adf6defc198485361f11a2d3dc0ecfe305d8489b7073ef59f2ad2a7655ad931a0897c936c5bb18b74e4794ec9058afe
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Documents\OneNote Notebooks\qap`g`v~dtlq
Size 10B
SHA256 d75eee151c25472390f874d438eb8a5aa7f48536b77067db9875f1b109939e76
MD5 d16113465f7ed35b0369bc3c978bef75
SHA1 93889a14ecdc37fe188809414c19b41dad563f21
SHA512 7dd165e9d2283c6741e8cb2855680e3bbf511705b3701aded03b70f3ecb1d0cb450217930d57d8863bd9aa86804f7d4959252eec727c2828ecca622563568f5b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 b8127be46046b93cf2878dcca450b51dfc7592fc840ddbd9fb4ed53ada9c0de5
MD5 549a56346ea65dab7a1d174c2a18645b
SHA1 8fa60dc3ccdeff029b31943f60d8619ff8dd248f
SHA512 68e0b3cebc5d14541e25ead93af3cd1832eb0569dca0f0268d804bf6576d671a790350c69a5c13e76f52251c7fb3bc9281945613a2218af6f74fe066d295afdc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 ec2208ab86c80c77cb750ae8762dab7e4f81f46fd0082dff48511abb51ca7afe
MD5 f6cf05c7a8c0eaf3aeea49b952e79574
SHA1 699eeb7624e59a076d9ffb27e08913ea943b408c
SHA512 9178866290923198ad1d6359e6b89ad9915a2c58e4c9fb7a6c65351fcec0971fc87cef0ea3665d6dd873794a025df9640b432a3323ddc5f0f429a15f26908a83
MD5 SHA1 SHA512

Submit Download

svchost_AABBAABCBAAABCAABACCCBBBBBCBCACABAAACCCAACBAAACBBAACCAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBAABCBAAABCAABACCCBBBBBCBCACABAAACCCAACBAAACBBAACCAA.exe
Size 20.8MB
SHA256 1d243673792c4adbf88a71a8ac212f7087f35c6773dbe7e8e4b7cfb74a643464
MD5 8251f64005da2fb64973baa85c95ad96
SHA1 f575165373234387598afe7551aeaadccb18a860
SHA512 633d91b04c78d5691b3faba5bcbff210a05981d074afc283005cb5e02be08922823d6ec68f4b6dfe11ee6dff34975f1e00746ab3738fddeb9919a69ec84b2ed0
SSDEEP 49152:U+E2+ESB+ES+E2+EE+ES+Ek+ES+ES+E2+ESB+ES+E2+EE+ES+Ek+ES+ES+E2+ESa:T
TLSH
T17D270909F94340B1DD2B50F04DCFE3BF8A60AB25C6128EF7FB4DCB5BA522BA16428555
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 c1cc8e4829a032b6687b27bb5e21cf142f7814af7fc8132f8851f795e0d02fb2
MD5 0402d7f281f31b487a7503f7dab3fcdd
SHA1 5ee199ba3b337773a78042bf4a0cf0dd58237000
SHA512 bf58868fe042eebc0c1682b8b21b654232cd05bffb41a93cefdeeb6600cdb6766dae254ec85d7c03b5b27dd8dabcc793c444faff7a36b4987bec1621c3fbc802
TLSH
T16A112E10A8E6E453FD333CCBD12A9B821CE4369F6C587A581309470D77D8D728D518E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 498a3b044abba3c90b5e72b9d42c96abb4ac3aba44ad0b462731b8f02810fb58
MD5 de51e19fc90443d70c2e17e6af3672ba
SHA1 9bd61fdfb81ca55d6c5412a8b8a96e637c97a967
SHA512 8a378e6f870fc4c45ebf61ff1217c445a94b7f07f58bd00b8ba9a41ee0449e435cd9746a8325e253302db740799b795ee888e6d7341d969b21e3deb6a07576f3
TLSH
T1F9212C50A8E6E857FD332CCBD12EAB421CA4369F6C587A982309470977D8D728D518E1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/988-93-0x00000000006D0000-0x00000000006F1000-memory.dmp

Download

memory/988-10-0x00000000006D0000-0x00000000006F1000-memory.dmp

Download

memory/988-62-0x00000000006D0000-0x00000000006F1000-memory.dmp

Download

memory/988-36-0x00000000006D0000-0x00000000006F1000-memory.dmp

Download

memory/988-23-0x00000000006D0000-0x00000000006F1000-memory.dmp

Download

memory/1640-101-0x00000000006B0000-0x00000000006D1000-memory.dmp

Download

memory/1640-2835-0x00000000006B0000-0x00000000006D1000-memory.dmp

Download

memory/3376-97-0x00000000008B0000-0x00000000008D1000-memory.dmp

Download

memory/3780-76-0x0000000004D70000-0x0000000004D71000-memory.dmp

Download

memory/4796-251-0x00000000006B0000-0x00000000006D1000-memory.dmp

Download

memory/4796-74-0x00000000006B0000-0x00000000006D1000-memory.dmp

Download

memory/4796-50-0x00000000006B0000-0x00000000006D1000-memory.dmp

Download

memory/4796-35-0x00000000006B0000-0x00000000006D1000-memory.dmp

Download